hi @rain Thanks for the very thorough testing and screenshot. So I looked at my test instance and actually I do see what you are seeing when you hover over a lookup: the root endpoint "/splunk" is not there BUT when I click on the csv in the lookup editor, I am able to edit the lookup.  Did you try to edit a lookup? I don't get an error at all and things do seem to work.   ... View more

Hi. I am not seeing this issue. Here's the output from btool to show the root_endpoint is splunk   /opt/splunk/bin/splunk btool web list --debug | grep root /opt/splunk/etc/system/local/web.conf root_endpoint = /splunk     If I click on the lookup editor I see this URL https://server:port/splunk/en-US/app/lookup_editor/lookup_list   So /splunk is there in the URL and the lookup editor works. Debugging ideas 1) run btool to make sure you have the endpoint setup as expected 2) possibly look in your logs for errors   ... View more

Hi @rain  I did a quick experiment as follows and did not have an issue with the lookup editor. 4.0 The path was correct as expected (/splunk was added).   /opt/splunk/etc/system/local/web.conf root_endpoint = /splunk   ... View more

Hi. Can you file a case with splunk support about this? ... View more

So in your query where you show the events, can you display the _time as well? ... View more

Hello. We can't see what time Splunk thinks those events arrived in. Do you have a props.conf for that sourcetype/source to tell the Splunk indexer which field you are using as the actual event time? https://docs.splunk.com/Documentation/Splunk/latest/Admin/propsconf Something like TIME_FORMAT=%s    (for unixtime format) TIME_PREFIX = time\":\s*\"     ... View more

Did anything change on your servers running Splunk? What version are you running? ... View more

Hi @siddharthprabhu  Whoever in your organization has access to create Splunk Support tickets can follow this https://community.splunk.com/t5/Random/How-do-i-file-a-Splunk-Support-Case-contact-Splunk-Support/td-p/148639 Thanks. ... View more

Hi. It would be great to file a ticket with Splunk Support to make sure they are aware of the bug.     ... View more

Hi what @ITWhisperer meant, I believe, is try the first line of your tstats by itself. If that works dd the second line etc.   What I do is to comment out the lines you don't want to run when three backs ticks. Then I have the query ready to uncomment. ... View more

Hi. The way we do it is with an app that we put on the Splunk deployer in a special app e.g. /opt/splunk/etc/shcluster/apps/my_idxcluster/default/server.conf Next we deploy  the app to the search head cluster members. The deployer will determine whether a rolling restart of the heads is needed. So we follow this https://docs.splunk.com/Documentation/Splunk/9.0.4/Indexer/Configuresearchheadwithserverconf For example this goes in /opt/splunk/etc/shcluster/apps/my_idxcluster/default/server.conf [clustering] manager_uri = https://indexer_cluster_manager_url:8089 mode = searchhead pass4SymmKey = whatever   ... View more

Yes so you can only refer to field names but not get multiple values of a field so you need to use stats or eval to create the fields you want  So like @PickleRick suggests  stats values(*) AS * And then use the actual fieldname in the body of the Slack alert eg $yourfield$ Here are more ideas https://community.splunk.com/t5/Splunk-Search/How-do-I-make-a-custom-alert-message-with-variables/m-p/438380#M174048 ... View more

Could you check the modification date on the file? If it was recent you could possibly check the audit log for someone using SPL to overwrite it? ... View more

Hi.  When you run tstats count by prefix(cod-data=) you end up getting counts for each value of cod-data. 0 <count of 0s> 1 <count of 1s> n <count of ns>  And then |eval Success=if(COD_data="0"  OR COD_data="", "Success", null()) |stats count(Success) as Successlogs  That will identify the fields where COD_data = 0 as Success Finally the count with Count the number of rows of Success.. which = 1 So something like |tstats count where index=app-cod-idx   host_ip=11.123.345.23  sourcetype=code:logs by PREFIX(cod-data=) |rename cod-data= as COD_data |where isnotnull(COD_data) | stats sum(eval(if(COD_data="0",count,0))) AS SuccessLogs, sum(eval(if(COD_data!="0",count,0))) AS FailedLogs,  sum(count) as totalcount The key is that you want to sum the count   ... View more

Hi can you provide curl example and error example? ... View more

When I saw these in Splunk 9.0.1 I opened case 3093336. Splunk's response is that AWSSDK will be disabled by default starting in version 9.1.0. AwsSDK errors are safe to ignore. Those messages are happening as part of the checks that were added to on-prem installation. I have requested an update to Splunk docs to properly reflect this. (Becky's note: I don't see this in known issues for 9.0.4) As a short term workaround you can add "category.AwsSDK=FATAL" under the [splunkd] stanza in $SPLUNK_HOME/etc/log.cfg to silence the message. I tested the above and it works but don't want the work to change the log.cfg as it changes with each version. Note they did not give me a way to disable. ... View more

Hi there's a conversation about this in the Splunk Slack channel for Splunk 9 upgrade issues and a user has reported the issue to Splunk. See https://splunk-usergroups.slack.com/archives/C03M9ENE6AD/p1679754016483519 for reference. ... View more

Hi. Just reading this one.. so your scripted input doesn't really belong to a user the way a knowledge object like a savedsearch AFAIK. So I would imagine the cron schedule is based on the timezone of the server it runs on. ... View more

Hi. You probably want to examine the script that was posted to upload the csv. The script doesn't just do a rest call with the file it loops through and reads the contents in python and then uploads a big string https://github.com/mthcht/lookup-editor_scripts/blob/main/upload_lookups_to_splunk.py#L39-L47     ... View more

Hi. Do you have access to the logs? Is there a permission error? ... View more

Thanks @mthcht I tested this in a single search head AND on a search head cluster and it worked in both cases. Thanks for publishing it! ... View more

There's a big discussion here https://community.splunk.com/t5/Splunk-Search/How-to-compute-indextime-time-difference-average-with-tstats/m-p/306878 ... View more

My point was someone asked if fixed in 8.2.4 and it is not. I ran the search as admin and it should not have failed. There are no other errors for this head at that time so I believe this is a bug. ... View more

We are on 8.2.7 and just saw this error so not fixed in 8.2.4 It was a very long running job with a lot, lot of events. ... View more